| commit | af4610c39589d839551da104f7da342d86f23ea0 | [log] [tgz] |
|---|---|---|
| author | Florian Westphal <fw@strlen.de> | Thu Feb 25 10:08:38 2016 +0100 |
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | Wed Mar 02 20:05:26 2016 +0100 |
| tree | dd1aa462199737434bccc9b2f54cb8595d4e1407 | |
| parent | 5f6c253ebe93b02dece01c6f58447f16b29f6dd3 [diff] |
netfilter: don't call hooks unless needed With the previous patches in place, a netns nf_hook_list might be empty, even if e.g. init_net performs filtering. Thus change nf_hook_thresh to check the hook_list as well before initializing hook_state and calling nf_hook_slow(). We still make use of static keys; if no netfilter modules are loaded list is guaranteed to be empty. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>